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I. PURPOSE AND SCOPE OF POLICY 

The Iowa Department of Public Health (IDPH) and local boards of health and health 
departments (including county, city, and district boards and departments) are governed 
by Iowa's Open Records law, and generally provide public access to all records they 
maintain. (Iowa Code chapter 22). In addition, IDPH and local boards of health and 
health departments are committed to providing information, data, and records to the 
public and the media to promote and protect the health of the population. 

However, Iowa law also provides that certain information, data, and records maintained 
by IDPH and local boards of health and health departments are confidential and may 
not be disclosed to the public, including records received and maintained by IDPH and 
local boards of health and health departments as a part of their efforts to track 
reportable diseases and control communicable disease outbreaks. (Iowa Code 
§139A.3). The purpose of this policy is to outline the legal status of records containing 
reportable disease information, and to provide guidance to IDPH employees and to local 
boards of health and health departments regarding the disclosure of such information. 

"Reportable disease" is defined in Iowa law as any disease or condition designated by 
IDPH as reportable, and includes over sixty diseases, conditions, and poisonings 
specifically named in administrative code. "Reportable disease" also includes any 
disease or condition that occurs in unusual numbers or circumstances, unusual 
syndromes, uncommon diseases, diseases and conditions suspected to be caused by a 



1 



deliberate act, and outbreaks of any kind. (641 Iowa Administrative Code (IAC) chapter 

I , Appendices A & B). Reportable disease records include any written or electronic 
document that contains reportable disease information, and include but are not limited 
to initial case reports, follow-up case investigations, information obtained during cluster 
and outbreak investigations (including e-mail based surveys like Survey Monkey), and 
medical records. 

II. IDENTIFIABLE INFORMATION IS CONFIDENTIAL 

As a general rule, reportable disease records and other information which identifies a 
person or business involved in a reportable disease investigation are confidential under 
Iowa law. The law specifically provides as follows: 

A report or other information provided to or maintained by the department, 
a local board, or a local department which identifies a person infected with 
or exposed to a reportable or other disease or health condition (or a 
business associated with a reportable or other disease or health condition) 
is confidential and shall not be accessible to the public. 

Information contained in a report may be reported in public health records 
in a manner which prevents the identification of any person or business 
named in the report. 

"Business" includes entities with identifiable proper names, such as schools, churches, 
non-profit organizations, restaurants, and companies. 

(Iowa Code § 139A.3(2)"b" & "c"; see also Iowa Code §§ 22.7(2), 22.7(16), 139A.30, 
641 IAC 1.17(1)). This section includes information about persons who have been 
diagnosed through positive test results or other means, and also includes information 
about persons for whom IDPH or local boards of health or health departments maintain 
pending or negative test results. 

Information which identifies a business named in a report is also confidential and shall 
not be accessible to the public. (Iowa Code § 139A.3(2)"c" and 641 IAC 1.17(2)). 
"Business" is defined broadly in the law as "every trade, occupation, or profession." 
(Iowa Code § 139A.2(2)). The identity of a business may be released in certain limited 
circumstances discussed in section IV of this policy. 

Identifiable information (or identifiers ) includes information that can be used to directly 
establish the identity of a person or business, such as a name, address, or unique 
identifying number. Identifiable information also includes information that can be used 
to indirectly establish the identity of a person or business by linking such information or 
data with external information that allows for identification of the person or business, 
such as obituaries, newspaper articles, or information on public websites. 
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III. STATISTICAL, AGGREGATE OR TABULAR DATA MAY BE RELEASED IN 
ACCORDANCE WITH THE FOLLOWING GUIDELINES 



Information contained in a disease report may be reported in public health records or 
otherwise released by IDPH or local boards of health or health departments only "in a 
manner which prevents the identification of any person or business named in the 
report." (Iowa Code § 139A.3(2)"c"; see also §139A.30). This provision authorizes 
IDPH and local boards of health and health departments to release disease information 
to the public so long as such release does not result in the identification of a person or 
business. IDPH and local boards of health and health departments may therefore 
generally release information or data in an aggregate or a tabular format. 

The determination of whether the release of aggregate information or tabular data would 
result in the identification of a person or business may be straightforward -- for example, 
IDPH can clearly report that the state experienced 1 ,066 cases of pertussis in 2008 
without violating confidentiality provisions. Likewise, IDPH clearly cannnot report that a 
39 year old African American male residing in Page County is infected with Lyme 
disease if there is only one 39 year old African American male residing in Page County, 
as such release would result in identification of this individual. Oftentimes, however, the 
determination of whether the release of information is consistent with confidentiality 
restrictions is more complex and may require additional analysis and consultation with 
these guidelines and the department's legal counsel and medical advisors. 

In determining whether release of aggregate information or tabular data would result in 
the identification of a person or business, IDPH will generally follow the Centers for 
Disease Control and Prevention's (CDC) scientifically acceptable principles for 
confidentiality protection. Specifically, IDPH has relied upon selected guidelines from 
the CDC's Staff Manual on Confidentiality, the National Center for Health Statistics Staff 
Manual on Confidentiality, and the CDC-CSTE Intergovernmental Data Release 
Guidelines Working Group Report: CDC-ATSDR Data Release Guidelines and 
Procedures for Re-Release of State- Provided Data, in preparing this policy. In addition, 
IDPH relied in part upon the Washington State Health Department's Guidelines for 
Working with Small Numbers in developing this policy. These sources can be found on 
agency specific web-sites. 

In general, the following guidelines apply to the release of reportable disease 
information by IDPH and local boards of health and health departments: 

Disclosure of Personal Identifiers Prohibited . 

■ IDPH and local boards and health departments shall not release information which 
directly identifies a person or business named in a reportable disease report, 
including name, address, telephone number, social security number, medical record 
number, exact date of subject's birth, or other direct identifiers. 
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Example: On January 1, 2009, a physician reports to the Johnson County 
Health Department and IDPH that Jane Doe, medical record number 
7654321, a female living at 100 Main Street in Iowa City, Iowa, has 
Salmonellosis. Jane Doe's name, medical record number, and address 
are confidential and cannot be released by either health department. 
However, her case will be added to the total number of Salmonellosis 
cases in Johnson County and the state for the year, and that total number 
may be released. 

Example: The Polk County Health Department is informed that Capitol 
City Restaurant has a cook named Jane Doe with Hepatitis B, a disease 
that is not transmissible in food or in a restaurant setting. Both the patient 
identifying information and the restaurant name are confidential and 
cannot be released to the public. 

■ IDPH and local boards of health and health departments shall not knowingly release 
information which can be used to indirectly establish the identity of a person or 
business named in a disease report by the linking of the released information or data 
with external information which allows for identification of such person or business. 

Example: John Doe, an 87 year old man from Dickinson County, dies of 
West Nile Virus on August 1, 2010. An obituary in the local paper states 
his age at death and the date of his death. If IDPH releases information 
that an 87 year old man from Dickinson County died on August 1 st from 
West Nile, that information could easily be linked with the obituary to 
establish his identity and that he was infected with this disease. For this 
reason IDPH and local boards of health and health departments should 
not release all of these specific identifiers about John Doe, but instead 
should broaden one or more of the identifiers to prevent the identification 
of John Doe. See how to broaden identifiers below. 

Certain media outlets have expressed an interest in receiving information about (1) 
county of residence, (2) age range in the general categories of child, young adult, adult, 
or elderly, (3) time frame identifier, and (4) health status. In some cases it will be 
appropriate to release information from all four categories as requested. Again, 
however, one or more identifiers may need to be broadened to ensure that the 
information provided cannot be linked with external information to allow for identification 
of such person or business - for example, county of residence could be broadened so 
that the release provides that an elderly person in northwest Iowa died of West Nile on 
August 1 , 201 0; or the time frame identified could be broadened, so that the release 
provides that an elderly person from Dickinson County died of West Nile in August of 
2010. See section VI concerning release of data to the media. 

Example: A seven year old black male in Taylor County has sickle cell 
anemia. This type of anemia is most commonly found in African- 
Americans. Since there are few African Americans in Taylor County, IDPH 
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and local boards of health and health departments should not publicly 
disclose that a seven year old in Taylor County has sickle cell anemia, as 
doing so could lead to the identification of the child. 

■ IDPH and local boards of health and health departments shall not respond to 
inquiries which include direct personal identifiers in a manner which confirms an 
inquiry. 

Example: IDPH stated in a press release that Toxic Shock syndrome 
caused the death of an Iowa adult in Winneshiek County in the month of 
August 2009. If a reporter asks whether Mary Smith was the woman in 
question, IDPH cannot confirm or deny the identity of the individual, as 
doing so would result in IDPH disclosing confidential information. In 
addition, if a member of the public asks for the final IDPH report of the 
outbreak investigation involving Mary Smith, IDPH may not respond to 
such inquiry as doing so would confirm that Mary Smith was the subject 
involved. IDPH may suggest that the public records request be 
broadened so that IDPH is not in jeopardy of revealing confidential 
information - for example, suggest that the request be made for all final 
public IDPH outbreak reports for the year 2009. 

Example: An employer contacts IDPH concerned about the health status 
of their employee Jane Smith, when told that this is confidential 
information, he then asks whether his business has an employee infected 
with Hepatitis C. IDPH cannot release any information about the health 
status of any individual employee to the employer, nor that any employee 
has been tested (regardless of whether the test results are negative or 
positive). 

Example: Little Johnny Doe goes to River City Elementary School, and 
develops pertussis. A local reporter calls and wants to know what school 
Johnny attends. IDPH and local boards of health and health departments 
cannot disclose any information that would confirm that Johnny has 
pertussis, nor can public health generally disclose the school involved in 
the pertussis outbreak. 

Aggregate Data Values . 

■ When releasing reportable disease information or data to the public, IDPH and local 
boards of health and health departments should expand or broaden the identifier 
fields as needed in order to prevent identification. Common methods for preventing 
identification include: 

o Redacting (removing) variables which directly identify a person or business, 
including name, address, telephone number, social security number, medical 
record number, exact date of case-patient's birth, or other direct identifiers. 
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o Collapsing continuous/interval data (ex: age, date of occurrence) into broad 
categories. 

o Collapsing ordinal data (ex: location, geography) into broad categories, 
o Suppressing of small numbers to ensure confidentiality 



Use Numerator/Cell Size Rules for Data Aggregation or Suppression . 

u When releasing reportable disease information or data to the public, IDPH and local 
boards of health and health departments should use numerator/cell size rules to 
either guide selection of groupings of aggregated data values, or if aggregation is 
insufficient, to suppress release of certain cells in a table. IDPH and local boards 
of health and health departments should not release data if the numerator cell 
size is three or less: numerator cell size counts of one, two, and three should 
not generally be disclosed. A count of no cases or events in the cell is not a threat 
to confidentiality and may be released, but a count of one, two, or three cases or 
events is a threat to confidentiality and should not be released. 

Definitions: 

A numerator is the number on top and a denominator is the number on the 
bottom of a ratio. For example, if 1 3 of 62 people who attended a church supper 
became ill, 13 is the numerator, and 62 is the denominator. 

A line listing is a row of data in which only one piece of information per category 
is available. For example, the number of cases per county is available in the line listing 
of reportable diseases in Iowa. (See example at 
www.idph.state.ia.us/adper/common/pdf/cade/decades.pdf ). 



Example: 





Polk 


Story 


Linn 


Hamilton 


Adair 


Adams 


Salmonella cases 


117 


51 


42 


8 


2 


1 



A table refers to the arrangement of descriptive or identifying data (for example 
age, sex, or race) in columns (vertical) and lines (horizontal), with the intersection of a 
column and a line referred to as a "cell", where several pieces of information are 
available per number. For example, the following hypothetical table of Salmonella 
cases in Polk County includes age and race. This sometimes referred to as "cross-tabs" 
when two pieces of identifying information (e.g., age and race) are used to arrange data 
in a table. 
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Salmonella cases in Polk County 


Race 


Age 0-17 


Age 18-40 


Age 41-60 


Age 61-80 


Age 81+ 


Total 


White 


22 


16 


13 


11 


10 


72 


Black 


11 


6 


4 


6 


8 


35 


Asian 


2 


1 


2 


1 


3 


9 


Pacific Islander 














1 


1 


Total 


35 


23 


19 


18 


22 


117 



Example: The suppressed version of the table above as it can be released to the 
public. (This assumes that there are more than 300 Asian/Pacific Islanders that are over 
age 80 in Polk County. If there were less than 300, consider combining the age 61-80 
and age 81+ to ensure that the denominator was large enough.) 



Salmonella Cases in Polk County 


Race 


Age 0-17 


Age 18-40 


Age 41-60 


Age 61-80 


Age 81+ 


Total 


White 


22 


16 


13 


11 


10 


72 


Black 


11 


6 


4 


6 


8 


35 


Asian / Pacific 
Islander 


S 


S 


S 


S 


4 


10 


Total 


S 


S 


S 


S 


22 


117 



S= suppressed number 



Example: A local health department is asked for information about 
pertussis by age and gender. The county has had two 3 year old males, two 4 
year old males, and one 5 year old male with pertussis. Because there are less 
than 3 in each cell, the county should collapse the individual ages into one cell of 
children five years of age and under, so the release of information would state 
the county has had five males 5 years of age or younger with pertussis. 

If data is released in table format, the following additional guidance should be followed: 

• In no table should all cases of any line or column be found in a single cell. 

• In no table should the total figure for a line or column of a cross-tabulation be 
three or less. 

• In no table should it be possible to identify a person or business through 
subtraction or other calculation from the table or a combination of tables. 

• Data released by IDPH or local boards of health and health departments should 
not permit identification of a person or business when used in combination with 
other external data. 

Use Denominator/Population Size Rules for Data Aggregation or Suppression . 

■ When releasing reportable disease information and data, IDPH and local boards of 
health and health departments should use denominator/population size rules to 
either guide selection of groupings of aggregated data values, or if aggregation is 
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insufficient, to suppress release of certain cells in a table. Prior to disseminating 
reportable disease information, IDPH and local boards of health and health 
departments should consider the size of the denominator (the population size 
represented in each cell of a table). Data should not be released if the total 
population from which the data are drawn is less than a certain size, based on the 
premise of a size sufficiently large enough that no subcell of the variables contained 
in the data would be expected to be smaller than a certain size. Generally, tabular 
data based on denominations greater than 300 persons per cell present minimal risk 
for personal identification. Caution should be exercised if the cell's population size is 
between 100 and 300, and release should not occur if the population is less than 
100. 

Example: Assume there is an outbreak of Giardiasis in Ayrshire, Iowa, 
population 202, where four ten year old's were infected with this disease. 
Public health authorities should not release that four ten year old children 
in Ayrshire were infected with Giardia, because even though the 
numerator/cell size is over three, the denominator/population size is below 
300. Because there is only a small number of ten year old children in this 
town, such release may in effect be identifying every one of these children 
as infected with Giardia. The release should instead provide the relevant 
information for the county. 

Summary 

• IDPH and local boards of health and health departments shall not release 
information which directly identifies a person or business named in a reportable 
disease report, nor respond to inquiries in a manner that confirms the identity of a 
person or business. 

• IDPH and local boards of health and health departments should generally not 
report cells with counts of three or less. 

• IDPH and local boards of health and health departments should be cautious 
when reporting rates or ratios based on denominators less than 300 and should 
not disclose data based on denominators less than 100. 

• IDPH and local boards of health and health departments should be cautious 
when reporting a specific disease in a minority population if a high proportion of 
the minority population has this disease, or if the disease is primarily found in a 
specific population. 

• When producing tables, IDPH and local boards of health and health departments 
should be careful that users cannot derive confidential information through a 
process of subtraction. 
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IV. IDENTITY OF BUSINESS MAY BE RELEASED UNDER LIMITED 
CIRCUMSTANCES 



Information concerning the identity of a business involved in a disease investigation 
may be released to the public when the State Epidemiologist or the Director of IDPH 
determines such a release of information necessary for the protection of the public. 
(Iowa Code § 139A.3(2)"c"). In these limited circumstances, efforts should be made to 
actively involve the business in the release of the information to mitigate damages to the 
reputation of the business to the extent feasible. 

Example: IDPH receives a report that a salad maker at a fast food 
restaurant in Ankeny is infected with Hepatitis A. The fast food restaurant 
accepts cash only, so there is no reliable method to trace and warn its 
customers. The State Epidemiologist determines that it is necessary for 
the protection of the public to release the name of the restaurant so that 
individuals who have eaten at the restaurant are aware that they may 
have been exposed to this disease, and may wish to get vaccinated. 
IDPH could appropriately issue a press release with the restaurant name 
and times of potential exposure. IDPH should make an effort to involve 
the restaurant in the press release and any media appearances and to 
discuss efforts the restaurant has undertaken to ensure that no customers 
become ill. 

Prior to releasing the name of a business, local boards of health and health 
departments must obtain a determination from the State Epidemiologist or the Director 
of IDPH that such a release is necessary to protect the public. Local boards of health 
and health departments and officials are not authorized under law to make such a 
determination independently. IDPH will typically consult with legal counsel prior to 
reaching this determination to ensure that the release of information is appropriate from 
a legal and a public health perspective. 

Recalls 

If a federal regulatory agency announces a recall of a particular product, the State 
Epidemiologist automatically deems a release of the name of any business identified in 
the recall as necessary for the protection of the public. Hence IDPH and local boards of 
health and health departments may refer to the proper name of the business identified 
in a federal recall announcement in any public release of information about the 
investigation. However, information which identified any person involved in such recall 
or investigation remains confidential. 

V. HIV/AIDS INFORMATION 

IDPH and local boards of health and health departments collect and maintain reports 
regarding individuals infected with AIDS-related conditions, including HIV. (Iowa Code 
§§ 139A.3, 141A.6, and 641 IAC 1.3). HIV and AIDS information is subject to stricter 
confidentiality protections under both federal and state law than other reportable 
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disease information maintained by IDPH and local boards of health and health 
departments. (Iowa Code § 141A.9, 42 CFR part 2). The law related to HIV/AIDS 
information does, however, authorize release of "medical or epidemiological information 
for statistical purposes in a manner such that no individual person can be identified." 
(Iowa Code § 141A.9(1)"g"). IDPH and local boards of health and health departments 
should follow this policy in determining whether a release of information for statistical 
purposes prevents identification of individual persons. 

VI. RELEASE OF DATA TO THE MEDIA 

An important mission of public health is informing the public through the media about 
issues which impact the public's health. IDPH and local boards of health and health 
departments should collaborate with their public information officers or other appropriate 
staff to determine the content, nature, and scope of information to be released to the 
media. 

When releasing demographic information regarding specific case-patients to the media, 
the following guidelines should generally be followed. In certain situations this level of 
detail may not be appropriate for release as described in this policy, and if there is a 
question about the specificity of information which should be disclosed consultation 
should be sought from legal counsel prior to release of the information. 

Age Range: 

The following age ranges should generally be used to report both illnesses and deaths. 
In press releases, the age ranges should be included in parenthesis within the text as 
demonstrated below. 

• Child (0-1 7 years of age) 

• Adult (1 8-40 years of age) 

• Middle age (41 -60 years of age) 

• Older Adult (61 -80 years of age) 

• Elderly (81 + years of age) 

Gender: The gender of the case patient should generally be released. 

Geographic information: The smallest geographical area as appropriate should 
generally be released. 

1 ) County (release name of county of residence) 

2) Region - five regions will be used for the state: 

a. Northeast (NE) 

b. Southeast (SE) 

c. Central 

d. Northwest (NW) 

e. Southwest (SW) 

3) State (as a whole) 



10 



Ethnic and Race: The ethnicity and race of a patient will not generally be disclosed in a 
press release. 

Example: A 3 year old girl from Clay County dies of H1N1 influenza and 
her obituary is published in the local paper and on the local funeral home's 
website. Because an obituary is in the public domain, children deaths are 
rare, and Clay County has a relatively small population, the following 
would generally be appropriate for release - "a female child (0-17 years of 
age) in Northwest Iowa died ofH1N1". 

Example: A 63 year old man in Scott County becomes ill from Lyme 
disease but does not die. Because he did not die there is not information 
in the public domain about his illness. In addition, illness in people of this 
age is not rare and Scott County has a relatively large population - hence 
the following would generally be appropriate for release - "an older adult 
(61-80 years of age) male lowan in Scott County became ill with Lyme 
disease". 

In unusual situations, or when unexpected information is in the public domain, the 
above standardized guidelines may need to be modified. These modifications should be 
consistent with other sections of these guidelines and consultation with public 
information officers and legal counsel may be appropriate. 

VII. LIMITED EXCEPTIONS WHICH AUTHORIZE RELEASE OF PERSONALLY 
IDENTIFIABLE INFORMATION 

In addition to those disclosures of information authorized above, Iowa law also allows 
IDPH to disclose reportable disease information under the following circumstances: 

• Reportable disease records and information may be shared by and between IDPH 
employees and local board of health and health department employees who have a 
need for the information in the performance of their duties. (Iowa Code § 1 39A.3, 
641 IAC 175.10(2)"a" & "e", 641 IAC 1.17(3)"a" & "b"). Hence, IDPH and local health 
department employees may share any information necessary to effectively conduct 
a disease investigation. 

• Reportable disease records and information may be shared with public health 
departments in other states or the CDC or other federal agencies when necessary 
for the other entity to perform their duties or as necessary to conduct the 
investigation. (641 IAC 175.1 0(2)"e", 641 IAC 1.17(3)"d"). Confidential information 
provided to other departments retains its confidential status and shall not be re- 
released by the receiving entity. In general, however, CDC and other federal 
agencies do not receive or retain individual identifying information. 
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Example: An Illinois resident is hospitalized in Davenport Iowa, and is reported 
to Iowa public health officials as being ill with Lyme disease. This information, 
including name, address, and phone number of the resident, may be shared with 
Illinois public health officials (both the state and the case's local health 
department) as this information is needed by them to conduct the investigation 
and perform their job duties. 

Example: Investigators from the CDC are in Iowa assisting in an investigation of 
a reportable disease (children attending a day care center with high levels of lead 
poisoning). As part of the investigation, the CDC investigators have access to 
the names and other identifying information of these children; however, this 
information is confidential. When the investigators return to CDC, all identifying 
information should be redacted from any records or copies of records they 
remove from the state. Instead, for example, identification (ID) numbers could be 
given to each child, and a log made linking the ID numbers to the children's 
names. Any information leaving the state would only have the ID numbers on 
them and the log would be maintained by the Iowa public health officials. The 
day care center could be referred to as "day care center A" in all documents, and 
the proper name redacted. 

• Reportable disease records and information may be shared with other state 
governmental entities when necessary for those entities to perform their job duties. 
However, this information must be kept confidential by the receiving agency. (641 
IAC 175.1 0(2)"d" & "e", 641 IAC 1.1 7(3)"d"). 

Example: IDPH staff investigating an outbreak Q Fever may share information 
with the Iowa Department of Agriculture and Land Stewardship (IDALS) as 
necessary for both agencies to conduct their respective investigations. However, 
IDALS would be required to maintain the confidentiality of this information. 

• Reportable disease records and information may be shared by and between IDPH 
and local public health employees and health care providers, hospitals, and 
laboratories, as necessary to effectively conduct an investigation and to provide 
appropriate medical care. (Iowa Code § 139A.3, 641 IAC 1.4, 641 IAC 1.17(3)"c") 

• Reportable disease records may be released to the subject of the record (the 
individual who became ill) upon receipt of a written authorization for release from the 
subject or the subject's legal representative. (641 Iowa Administrative Code 

1 75.1 2). IDPH should exercise caution to ensure that other confidential information 
(i.e. reference to other ill individuals or involved businesses) contained in the report 
is redacted prior to release to the subject. 

• Reportable disease records may be released in response to a court order or 
subpoena. (641 IAC 175.9(2)"g"). Review shall be performed by the IDPH's legal 
counsel or local board of health and health department's legal counsel prior to 
release. 
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• Reportable disease information may be included in a quarantine or isolation order or 
site placard as necessary to prevent the spread of a quarantinable disease. (Iowa 
Code § 139A.4, 139A.5, 641 IAC 1.9, 641 IAC 1.17(3)"e"). Public health officials 
should exercise caution prior to posting such placards, and consult with IDPH's legal 
counsel or the local board of health and health department's legal counsel prior to 
taking action. 

• IDPH may share personally identifiable information regarding diseases, health 
conditions, unusual clusters, or suspicious events that may be the cause of a public 
health disaster with the department of public safety, the homeland security and 
emergency management division of the department of public defense, and other 
appropriate federal, state, and local agencies and officials. (Iowa Code § 
135.145(2)). The sharing of such information must be restricted to only that 
information necessary to prevent, control, and investigate the public health disaster. 
(Iowa Code § 135.145(3)). 

• Personally identifiable information regarding AIDS/HIV may be released only in the 
limited circumstances authorized by Iowa Code section 141 A. 9. 

VIII. PENALTIES FOR UNAUTHORIZED RELEASE OF INFORMATION 

A person who knowingly violates the confidentiality statutes and administrative rules 
cited above may be subject to criminal prosecution for a simple misdemeanor and may 
be subject to disciplinary action under IDPH or the relevant county's personnel policies, 
up to and including discharge from employment. A person who releases HIV/AIDS 
information is subject to criminal prosecution for an aggravated misdemeanor and is 
subject to civil action and civil penalties, and may be subject to disciplinary action under 
IDPH or the relevant county's personnel policies, up to and including discharge from 
employment. (Iowa Code §§ 139A.25, 141 A.11). 

In addition, while IDPH is not a covered entity under the Health Insurance Portability 
and Accountability Act of 1996 (HIPAA), local boards of health and health departments 
generally are covered entities, and may therefore be subject to an enforcement action 
under HIPAA if the local board of health or health department releases protected health 
information in violation of that regulation. Local boards of health and health 
departments should seek advice from their legal counsel to ensure their compliance 
with the federal law. 

Hospitals, health care providers, and other covered entities are not precluded by HIPAA 
from sharing reportable disease information with public health authorities or from 
participating in disease outbreak investigations and such entities must under state law 
provide this information to IDPH and local boards of health and health departments. 
(Iowa Code chapter 1 39A, 641 IAC chapter 1 ; 45 CFR 1 60.203; 45 CFR 1 64.51 2(a); 45 
CFR 1 64.51 2(b)(1)(i)). 
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IX. QUESTIONS REGARDING APPLICATION OF THE GUIDELINES 



Questions regarding application of these guidelines in specific circumstances may be 
directed to the following individuals: 

Patricia Quinlisk, MD, MPH 
Medical Director/State Epidemiologist 
Iowa Department of Public Health 
(515) 281-4941 
pquinlis@idph.state.ia.us 

Heather Adams, JD 
Assistant Attorney General 
Iowa Attorney General's Office 
(515) 281-3441 
hadams@ag.state.ia.us 

[Policy last revised August 25, 2010] 
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